Claude Code extension update leaves host backdoors behind
OpenSourceMalware disclosed that Anthropic’s official Claude Code for VS Code extension, version 2.1.313, was compromised to install an SSH backdoor. Anthropic had removed it and published version 2.1.314 by Oct. 30, 2026; how the compromise happened remains unknown.
The extension added an attacker-controlled key to `authorized_keys`, the file that controls SSH logins, labeling it “svc-telemetry,” and installed separate startup tasks. It also sent host details to the attacker. Cursor said enabling SSH often failed on Windows and macOS without admin rights, but the key, persistence, and data collection could still remain.
For any developer machine that ran 2.1.313, installing the clean extension does not show that the host is clean. The same gap matters wherever trusted editor add-ons can change login or startup state.